From b5f797d398239ece2a6d8244ee46d2590dabe34f Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 11 Oct 2024 16:34:05 -0500 Subject: [PATCH 1/2] Framework: Add Data type to TreeGrid This adds a `Data` base type, which will provide the information (layer_name and offset) required to view variable amounts of data both before and after that offset, instead of handing fixed-sized chunks of data back. This will allow plugin consumers to flexibly determine how much data to render/extract without having to re-run the plugin with different parameter values. --- volatility3/framework/interfaces/renderers.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index b13de18349..743017b199 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -102,6 +102,14 @@ class BaseAbsentValue(object): """Class that represents values which are not present for some reason.""" +class Data(object): + """Class that represents a view of data in a particular layer""" + + def __init__(self, offset: int, layer_name: str): + self.layer_name = layer_name + self.offset = offset + + class Disassembly(object): """A class to indicate that the bytes provided should be disassembled (based on the architecture)""" @@ -132,6 +140,7 @@ def __init__( Type[datetime.datetime], Type[BaseAbsentValue], Type[Disassembly], + Type[Data], ] ColumnsType = List[Tuple[str, BaseTypes]] VisitorSignature = Callable[[TreeNode, _Type], _Type] @@ -157,6 +166,7 @@ class TreeGrid(object, metaclass=ABCMeta): bytes, datetime.datetime, Disassembly, + Data, ) def __init__(self, columns: ColumnsType, generator: Generator) -> None: From 3f64176541ae4cb83cd8ad34552c0cf54c02a5d1 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Sun, 13 Oct 2024 14:26:50 -0500 Subject: [PATCH 2/2] Add length member to Data class --- volatility3/framework/interfaces/renderers.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index 743017b199..61f6f57e9b 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -105,9 +105,10 @@ class BaseAbsentValue(object): class Data(object): """Class that represents a view of data in a particular layer""" - def __init__(self, offset: int, layer_name: str): + def __init__(self, offset: int, layer_name: str, length: int): self.layer_name = layer_name self.offset = offset + self.length = length class Disassembly(object):